SECURITY: Fix accidental public CC headers in img_auth.php

[lhc/web/wiklou.git] / img_auth.php

diff --git a/img_auth.php b/img_auth.php
index 914014d..44ef0a1 100644 (file)
--- a/img_auth.php
+++ b/img_auth.php
@@ -39,6 +39,7 @@
  */
 
 define( 'MW_NO_OUTPUT_COMPRESSION', 1 );
+define( 'MW_ENTRY_POINT', 'img_auth' );
 require __DIR__ . '/includes/WebStart.php';
 
 # Set action base paths so that WebRequest::getPathInfo()
@@ -53,9 +54,10 @@ $mediawiki->doPostOutputShutdown( 'fast' );
 
 function wfImageAuthMain() {
        global $wgImgAuthUrlPathMap;
+       $permissionManager = \MediaWiki\MediaWikiServices::getInstance()->getPermissionManager();
 
        $request = RequestContext::getMain()->getRequest();
-       $publicWiki = in_array( 'read', User::getGroupPermissions( [ '*' ] ), true );
+       $publicWiki = in_array( 'read', $permissionManager->getGroupPermissions( [ '*' ] ), true );
 
        // Get the requested file path (source file or thumbnail)
        $matches = WebRequest::getPathInfo();
@@ -95,8 +97,10 @@ function wfImageAuthMain() {
                        }
                        if ( $be->fileExists( [ 'src' => $filename ] ) ) {
                                wfDebugLog( 'img_auth', "Streaming `" . $filename . "`." );
-                               $be->streamFile( [ 'src' => $filename ],
-                                       [ 'Cache-Control: private', 'Vary: Cookie' ] );
+                               $be->streamFile( [
+                                       'src' => $filename,
+                                       'headers' => [ 'Cache-Control: private', 'Vary: Cookie' ]
+                               ] );
                        } else {
                                wfForbidden( 'img-auth-accessdenied', 'img-auth-nofile', $path );
                        }
@@ -160,7 +164,6 @@ function wfImageAuthMain() {
 
                // Check user authorization for this title
                // Checks Whitelist too
-               $permissionManager = \MediaWiki\MediaWikiServices::getInstance()->getPermissionManager();
 
                if ( !$permissionManager->userCan( 'read', $user, $title ) ) {
                        wfForbidden( 'img-auth-accessdenied', 'img-auth-noread', $name );